Toolbelt
Overview
Real tools beat pattern sweeps. Never abandon an audit or build just because a scanner or runtime is missing: check availability first, install what you can without root, and only then fall back to manual analysis. Always say which tools you used and which were unavailable.
Resolution order
For each required tool, stop at the first step that works:
- Already on PATH -
command -v <tool>. Use it.
- Python CLI - run ephemerally with
uvx <tool> (preferred, zero install) or pipx run <tool>; for repeated use, uv tool install <tool> or python3 -m pip install --user <tool>.
- Node CLI -
npx --yes <tool> when node is present.
- Static binary - download the official release for the current OS/arch into
~/.local/bin, chmod +x, and ensure ~/.local/bin is on PATH. Works without root for Go-built tools (gitleaks, osv-scanner, trivy, hadolint, shellcheck) and even for Node itself (official tarball unpacked in $HOME).
- Degrade gracefully - do the manual equivalent (grep sweeps, lockfile reading, config review) and state clearly which tool was missing and what it would have added.
Domain map
| Need |
First choice |
Fallbacks |
| Secrets scan |
gitleaks (static binary) |
uvx detect-secrets, pattern sweep + git log -p |
| Python SAST/lint |
uvx bandit, uvx ruff |
manual sink review |
| Multi-language SAST |
uvx semgrep |
targeted grep per sink class |
| Python deps CVEs |
uvx pip-audit |
read lockfile, check versions |
| JS/TS deps CVEs |
npm audit (needs npm only) |
osv-scanner binary, lockfile review |
| Multi-ecosystem CVEs |
osv-scanner (static binary) |
per-ecosystem native scanner |
| Containers/IaC |
trivy (static binary), uvx checkov |
manual Dockerfile/manifest review |
| Dockerfile lint |
hadolint (static binary) |
manual best-practices check |
| JS lint/types |
npx --yes eslint, npx --yes tsc --noEmit |
read tsconfig + spot checks |
Rules
- No
sudo, no apt install in restricted or containerized environments - everything goes to $HOME (~/.local/bin, uv tool, pip --user).
- Respect the exec sandbox and allowlist; if an install is denied, fall back instead of retrying.
- Time-box bootstrapping: a couple of minutes at most. The mission is the audit/build, not the tooling.
- Pin nothing blindly: prefer latest stable releases from official sources only (GitHub releases, PyPI, npm registry).
- Report at the end: tools used, tools installed (and where), tools unavailable and the fallback applied.
Anti-patterns
- Failing the whole task because one scanner is missing
- Spending the entire turn compiling or troubleshooting an install
- Piping
curl into a shell, or fetching binaries from unofficial mirrors
- Installing system-wide or modifying the base image at runtime
- Silently skipping a check without disclosing the missing tool
1---2name: toolbelt3description: Verify and install missing CLI tools on demand - scanners, linters, runtimes - without root, using uvx, npx, or static binaries in ~/.local/bin. Use at the start of any audit, scan, or build when a needed tool may be absent.4---56# Toolbelt78## Overview910Real tools beat pattern sweeps. Never abandon an audit or build just because a scanner or runtime is missing: check availability first, install what you can without root, and only then fall back to manual analysis. Always say which tools you used and which were unavailable.1112## Resolution order1314For each required tool, stop at the first step that works:15161. **Already on PATH** - `command -v <tool>`. Use it.172. **Python CLI** - run ephemerally with `uvx <tool>` (preferred, zero install) or `pipx run <tool>`; for repeated use, `uv tool install <tool>` or `python3 -m pip install --user <tool>`.183. **Node CLI** - `npx --yes <tool>` when `node` is present.194. **Static binary** - download the official release for the current OS/arch into `~/.local/bin`, `chmod +x`, and ensure `~/.local/bin` is on PATH. Works without root for Go-built tools (gitleaks, osv-scanner, trivy, hadolint, shellcheck) and even for Node itself (official tarball unpacked in `$HOME`).205. **Degrade gracefully** - do the manual equivalent (grep sweeps, lockfile reading, config review) and state clearly which tool was missing and what it would have added.2122## Domain map2324| Need | First choice | Fallbacks |25|------|--------------|-----------|26| Secrets scan | `gitleaks` (static binary) | `uvx detect-secrets`, pattern sweep + `git log -p` |27| Python SAST/lint | `uvx bandit`, `uvx ruff` | manual sink review |28| Multi-language SAST | `uvx semgrep` | targeted grep per sink class |29| Python deps CVEs | `uvx pip-audit` | read lockfile, check versions |30| JS/TS deps CVEs | `npm audit` (needs npm only) | `osv-scanner` binary, lockfile review |31| Multi-ecosystem CVEs | `osv-scanner` (static binary) | per-ecosystem native scanner |32| Containers/IaC | `trivy` (static binary), `uvx checkov` | manual Dockerfile/manifest review |33| Dockerfile lint | `hadolint` (static binary) | manual best-practices check |34| JS lint/types | `npx --yes eslint`, `npx --yes tsc --noEmit` | read tsconfig + spot checks |3536## Rules37381. No `sudo`, no `apt install` in restricted or containerized environments - everything goes to `$HOME` (`~/.local/bin`, `uv tool`, `pip --user`).392. Respect the exec sandbox and allowlist; if an install is denied, fall back instead of retrying.403. Time-box bootstrapping: a couple of minutes at most. The mission is the audit/build, not the tooling.414. Pin nothing blindly: prefer latest stable releases from official sources only (GitHub releases, PyPI, npm registry).425. Report at the end: tools used, tools installed (and where), tools unavailable and the fallback applied.4344## Anti-patterns4546- Failing the whole task because one scanner is missing47- Spending the entire turn compiling or troubleshooting an install48- Piping `curl` into a shell, or fetching binaries from unofficial mirrors49- Installing system-wide or modifying the base image at runtime50- Silently skipping a check without disclosing the missing tool
Navinspire-ia